electron

@authdog/electron

Authdog SDK for Electron desktop apps — sign-in via the system browser with a deep-link callback, a pluggable token store, and user resolution against the OIDC userinfo endpoint. Built on @authdog/node-commons, so public-key parsing and the trusted identity-host allowlist are shared with the rest of the Authdog Web SDK.

Install

bun add @authdog/electron

Electron itself stays a dependency of your app, not of this package. Pass shell.openExternal (or createElectronOpener(shell)) so sign-in opens the system browser, and register a custom protocol so the OS can deliver the callback.

Quick start

import { app, shell } from "electron";
import { createAuthdogClient, createElectronOpener } from "@authdog/electron";

const authdog = createAuthdogClient({
  publicKey: "pk_…",
  redirectUri: "myapp://auth/callback",
  openUrl: createElectronOpener(shell),
});

if (process.defaultApp) {
  if (process.argv.length >= 2) {
    app.setAsDefaultProtocolClient("myapp", process.execPath, [
      process.argv[1],
    ]);
  }
} else {
  app.setAsDefaultProtocolClient("myapp");
}

app.on("open-url", (_event, url) => {
  void authdog.handleCallback(url);
});

signinButton.on("click", () => void authdog.signIn());
signoutButton.on("click", () => void authdog.signOut());

How it works

• signIn({ prompt? }) / signUp() — build the OIDC authorize URL and open it with openUrl (defaults to window.open in a renderer). The provider redirects to your redirectUri deep link.
• handleCallback(url) — extracts the token from the deep-link URL (query or fragment, custom schemes supported), persists JWT-shaped values, and returns the token or null.
• getToken() / isAuthenticated() — read the persisted token from the configured TokenStorage (defaults to localStorage when a window exists; inject safeStorage in the main process).
• getUser() — calls userinfo with the stored token; returns the user or null. Never throws.
• signOut() — clears the persisted token.

Security

• The public key is validated and parsed once; a malformed or untrusted key (identity host not on the allowlist) throws immediately.
• Credentials never pass through the app window — sign-in happens in the system browser. Only JWT-shaped tokens are persisted, and the token is only ever sent to the trusted, https: identity host enforced by @authdog/node-commons.
• isAuthenticated() reflects token presence only — a UI hint. Enforce every protected operation server-side.

License

MIT